Static analysis is often used by computer software developers to provide information about computer software while applying only static considerations (i.e., without executing a computer software application). One type of static analysis, commonly referred to as static security analysis, is designed to uncover security vulnerabilities within computer software. Unfortunately, static analysis tools that perform static security analysis often provide hundreds or even thousands of findings that include many false positive reports of security vulnerabilities. This is due to the inherent limitations of static analysis, which operates on an abstract—and therefore imprecise—representation of a subject computer software application. Moreover, even among the real security vulnerabilities discovered by the analysis, not all the findings are equally important, as some of the vulnerabilities may be more exploitable than others, while some may be inherently more severe than others.